NOFORK_NOEXEC.lst

   1 Why an applet can't be NOFORK or NOEXEC?
   2
   3 Why can't be NOFORK:
   4 interactive: may wait for user input, ^C has to work
   5 spawner: "tool PROG ARGS" which changes program's environment - must fork
   6 changes state: e.g. environment, signal handlers
   7 runner: sometimes may run for long(ish) time, and/or works with network:
   8         ^C has to work (cat BIGFILE, chmod -R, ftpget, nc)
   9
  10 "runners" can become eligible after hush is taught ^C to interrupt NOFORKs!
  11
  12 Why can't be NOEXEC:
  13 suid: runs under different uid - must fork+exec
  14
  15 Why shouldn't be NOFORK/NOEXEC:
  16 complex: no immediately obvious reason why NOFORK wouldn't work,
  17         but does some non-obvoius operations (example: fuser, lsof, losetup);
  18         nested xmallocs (typical in complex code) is a problem for NOFORK
  19 rare: not used often enough to bother optimizing (example: poweroff)
  20 longterm: often runs for a long time (many seconds), execing would make
  21         memory footprint smaller
  22 daemon: runs indefinitely
  23
  24 [ - NOFORK
  25 [[ - NOFORK
  26 acpid - daemon
  27 add-shell
  28 addgroup
  29 adduser
  30 adjtimex
  31 ar - runner
  32 arch - NOFORK
  33 arp
  34 arping - runner
  35 ash - interactive
  36 awk - noexec. runner
  37 base64 - runner
  38 basename - NOFORK
  39 beep
  40 blkdiscard
  41 blkid
  42 blockdev
  43 bootchartd - daemon
  44 brctl
  45 bunzip2 - runner
  46 busybox
  47 bzcat - runner
  48 bzip2 - runner
  49 cal - runner: cal -n9999
  50 cat - runner
  51 chat
  52 chattr - runner
  53 chgrp - noexec. runner
  54 chmod - noexec. runner
  55 chown - noexec. runner
  56 chpasswd - runner (list of "user:password"s from stdin)
  57 chpst - spawner
  58 chroot - spawner
  59 chrt - spawner
  60 chvt
  61 cksum - noexec. runner
  62 clear - NOFORK
  63 cmp - runner
  64 comm - runner
  65 conspy - interactive
  66 cp - noexec. runner
  67 cpio - runner
  68 crond - daemon
  69 crontab
  70 cryptpw
  71 cttyhack - spawner
  72 cut - noexec. runner
  73 date - noexec. nofork candidate(needs to stop messing up env, free xasprintf result, not use xfuncs after xasprintf)
  74 dc - runner (eats stdin if no params)
  75 dd - noexec. runner
  76 deallocvt
  77 delgroup
  78 deluser
  79 depmod
  80 devmem - runner, complex (access to device memory may hang)
  81 df - complex (nested allocs)
  82 dhcprelay - daemon
  83 diff - runner
  84 dirname - NOFORK
  85 dmesg - runner
  86 dnsd - daemon
  87 dnsdomainname - DNS resolution may trigger, need ^C
  88 dos2unix - noexec. runner
  89 dpkg - runner
  90 du - runner
  91 dumpkmap
  92 dumpleases
  93 echo - NOFORK
  94 ed - interactive
  95 egrep - runner
  96 eject
  97 env - noexec. changes state (env)
  98 envdir - spawner
  99 envuidgid - spawner
 100 expand - runner
 101 expr - complex (nested allocs)
 102 factor - runner (eats stdin if no params)
 103 fakeidentd - daemon
 104 false - NOFORK
 105 fatattr - complex (xopen+xioctl can leak fd)
 106 fbset
 107 fbsplash - runner, interactive
 108 fdflush
 109 fdformat - runner
 110 fdisk - interactive
 111 fgconsole
 112 fgrep - runner
 113 find - noexec. runner
 114 findfs - suid
 115 flash_eraseall
 116 flash_lock
 117 flash_unlock
 118 flashcp
 119 flock
 120 fold - noexec. runner
 121 free - nofork candidate(struct globals, needs to close /proc/meminfo fd)
 122 freeramdisk
 123 fsck - interactive
 124 fsck.minix
 125 fsfreeze
 126 fstrim
 127 fsync - NOFORK
 128 ftpd - daemon
 129 ftpget - runner
 130 ftpput - runner
 131 fuser - complex
 132 getopt - noexec. complex (many allocs)
 133 getty - interactive
 134 grep - runner
 135 groups - noexec
 136 gunzip - runner
 137 gzip - runner
 138 halt - rare
 139 hd - noexec. runner
 140 hdparm - complex, rare
 141 head - noexec. runner
 142 hexdump - noexec. runner
 143 hostid - NOFORK
 144 hostname - DNS resolution may trigger, need ^C
 145 httpd - daemon
 146 hush - interactive
 147 hwclock
 148 i2cdetect
 149 i2cdump
 150 i2cget
 151 i2cset
 152 id - noexec
 153 ifconfig
 154 ifenslave
 155 ifplugd - daemon
 156 inetd - daemon
 157 init - daemon
 158 inotifyd - daemon
 159 insmod - noexec
 160 install - runner
 161 ionice - spawner
 162 iostat - runner
 163 ip - noexec candidate
 164 ipaddr - noexec candidate
 165 ipcalc - noexec candidate
 166 ipcrm - noexec candidate
 167 ipcs - noexec candidate
 168 iplink - noexec candidate
 169 ipneigh - noexec candidate
 170 iproute - noexec candidate
 171 iprule - noexec candidate
 172 iptunnel - noexec candidate
 173 kbd_mode
 174 kill - NOFORK
 175 killall - NOFORK
 176 killall5 - NOFORK
 177 klogd - daemon
 178 last - runner (I've got 1300 lines of output when tried it)
 179 less - interactive
 180 link - NOFORK
 181 linux32 - spawner
 182 linux64 - spawner
 183 linuxrc - daemon
 184 ln - noexec
 185 loadfont
 186 loadkmap
 187 logger - runner
 188 login - suid, interactive
 189 logname - NOFORK
 190 losetup - complex
 191 lpd - daemon
 192 lpq - runner
 193 lpr - runner
 194 ls - noexec. runner
 195 lsattr
 196 lsmod - noexec
 197 lsof - complex
 198 lspci
 199 lsscsi
 200 lsusb
 201 lzcat - runner
 202 lzma - runner
 203 lzop - runner
 204 lzopcat - runner
 205 makedevs
 206 makemime - runner
 207 man - spawner, interactive
 208 md5sum - noexec. runner
 209 mdev - daemon
 210 mesg
 211 microcom - interactive, complex
 212 mkdir - NOFORK
 213 mkdosfs
 214 mke2fs
 215 mkfifo - noexec
 216 mkfs.ext2
 217 mkfs.minix
 218 mkfs.vfat
 219 mknod - noexec
 220 mkpasswd
 221 mkswap
 222 mktemp
 223 modinfo - noexec
 224 modprobe - noexec
 225 more - interactive
 226 mount - suid
 227 mountpoint
 228 mpstat
 229 mt
 230 mv - runner (can be noexec?)
 231 nameif
 232 nbd-client
 233 nc - runner
 234 netstat - runner with -c
 235 nice - spawner
 236 nl - runner
 237 nmeter - runner
 238 nohup - spawner
 239 nproc - NOFORK
 240 ntpd - daemon
 241 od - runner
 242 openvt - spawner
 243 partprobe
 244 passwd - suid
 245 paste - noexec. runner
 246 patch
 247 pgrep - nofork candidate(xregcomp, procps_scan - are they ok?)
 248 pidof - nofork candidate(uses find_pid_by_name, is that ok?)
 249 ping - suid, runner
 250 ping6 - suid, runner
 251 pipe_progress
 252 pivot_root
 253 pkill - nofork candidate(xregcomp, procps_scan - are they ok?)
 254 pmap
 255 popmaildir - runner
 256 poweroff - rare
 257 powertop - interactive, longterm
 258 printenv - NOFORK
 259 printf - NOFORK
 260 ps - noexec candidate
 261 pscan - longterm
 262 pstree
 263 pwd - NOFORK
 264 pwdx - NOFORK
 265 raidautorun
 266 rdate
 267 rdev
 268 readlink - NOFORK
 269 readprofile
 270 realpath - NOFORK
 271 reboot - rare
 272 reformime - runner
 273 remove-shell
 274 renice - nofork candidate(uses getpwnam, is that ok?)
 275 reset - spawner (execs "stty")
 276 resize - noexec. changes state (signal handlers)
 277 rev - runner
 278 rm - noexec. rm -i interactive
 279 rmdir - NOFORK
 280 rmmod - noexec
 281 route
 282 rpm - runner
 283 rpm2cpio - runner
 284 rtcwake - complex, rare
 285 run-parts
 286 runlevel
 287 runsv - daemon
 288 runsvdir - daemon
 289 rx - runner
 290 script
 291 scriptreplay
 292 sed - runner
 293 sendmail - runner
 294 seq - noexec. runner
 295 setarch - spawner
 296 setconsole
 297 setfont
 298 setkeycodes
 299 setlogcons
 300 setpriv - spawner
 301 setserial
 302 setsid - spawner
 303 setuidgid
 304 sh - interactive
 305 sha1sum - noexec. runner
 306 sha256sum - noexec. runner
 307 sha3sum - noexec. runner
 308 sha512sum - noexec. runner
 309 showkey - interactive
 310 shred - runner
 311 shuf - noexec. runner
 312 slattach
 313 sleep - runner
 314 smemcap - runner
 315 softlimit - spawner
 316 sort - noexec. runner
 317 split - runner
 318 ssl_client - network
 319 start-stop-daemon
 320 stat - nofork candidate(needs fewer allocs)
 321 strings - runner
 322 stty
 323 su - suid, spawner
 324 sulogin - spawner
 325 sum - runner
 326 sv
 327 svc
 328 svlogd - daemon
 329 swapoff - rare
 330 swapon - rare
 331 switch_root - spawner, rare, changes state
 332 sync - NOFORK
 333 sysctl
 334 syslogd - daemon
 335 tac - noexec. runner
 336 tail - runner
 337 tar - runner
 338 taskset - spawner
 339 tcpsvd - daemon
 340 tee - runner
 341 telnet - interactive
 342 telnetd - daemon
 343 test - NOFORK
 344 tftp - runner
 345 tftpd - daemon
 346 time - spawner, changes state (signals)
 347 timeout - spawner, changes state (signals)
 348 top - interactive, longterm
 349 touch - NOFORK
 350 tr - runner
 351 traceroute - suid, runner
 352 traceroute6 - suid, runner
 353 true - NOFORK
 354 truncate - NOFORK
 355 tty - NOFORK
 356 ttysize - NOFORK
 357 tunctl
 358 tune2fs
 359 ubiattach
 360 ubidetach
 361 ubimkvol
 362 ubirename
 363 ubirmvol
 364 ubirsvol
 365 ubiupdatevol
 366 udhcpc - daemon
 367 udhcpd - daemon
 368 udpsvd - daemon
 369 uevent - daemon
 370 umount
 371 uname - NOFORK
 372 uncompress - runner
 373 unexpand - runner
 374 uniq - runner
 375 unix2dos - noexec. runner
 376 unlink - NOFORK
 377 unlzma - runner
 378 unlzop - runner
 379 unxz - runner
 380 unzip - runner
 381 uptime - nofork candidate(is getutxent ok?)
 382 users - nofork candidate(is getutxent ok?)
 383 usleep - NOFORK
 384 uudecode - runner
 385 uuencode - runner
 386 vconfig
 387 vi - interactive
 388 vlock - suid
 389 volname - runner
 390 w
 391 wall - suid
 392 watch - runner
 393 watchdog - daemon
 394 wc - runner
 395 wget - runner
 396 which - NOFORK
 397 who
 398 whoami - NOFORK
 399 whois
 400 xargs - noexec. spawner
 401 xxd - noexec. runner
 402 xz - runner
 403 xzcat - runner
 404 yes - noexec. runner
 405 zcat - runner
 406 zcip - daemon